CVE-2026-32673
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability in BIG-IP scripted monitors allows an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.
Risk Assessment
The risk involves potential privilege escalation and unauthorized command execution, which could lead to full compromise of the BIG-IP system and breach of security isolation in the environment.
Recommendation
It is recommended to immediately update BIG-IP to a patched version and minimize the number of users with Resource Administrator and Administrator roles to the necessary minimum.
Other vulnerabilities in BIG-IP
See all- CVE-2017-6168High
BIG-IP versions 11.6.0-11.6.2, 12.0.0-12.1.2, and 13.0.0-13.0.0 are vulnerable to an Adaptive Chosen Ciphertext attack, also known as the Bleichenbacher attack. Exploiting this vulnerability may lead to plaintext recovery of encrypted messages and/or a Man-in-the-middle attack.
- CVE-2026-59762High
A vulnerability in the HTTP/2 profile on a BIG-IP virtual server allows an unauthenticated attacker to remotely cause increased memory utilization. This can lead to system performance degradation until the TMM process is forced or manually restarted.
- CVE-2026-40698High
A vulnerability in BIG-IP and BIG-IQ systems allows an authenticated attacker with at least the Resource Administrator role to escalate privileges by creating SNMP configuration objects via iControl REST or the TMOS shell (tmsh).
- CVE-2026-40618High
A vulnerability in BIG-IP allows TMM termination by undisclosed traffic when an SSL profile is configured on Virtual Edition without QAT or on hardware with disabled hardware acceleration.
- CVE-2026-40061High
In BIG-IP with DNS provisioned, a vulnerability exists in an undisclosed iControl REST and tmsh command. An authenticated attacker with Resource Administrator or Administrator role can execute arbitrary system commands with elevated privileges.
- CVE-2026-40060High
A vulnerability in BIG-IP Advanced WAF and ASM allows undisclosed requests to terminate the bd process when a security policy is configured on a virtual server.
- CVE-2026-39455High
In the BIG-IP Configuration utility configured to use LDAP authentication, undisclosed traffic can cause the httpd process to exhaust available file descriptors.
Original NVD description (English source)
A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.